Role-Based Authorization Model with Dynamic Role Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based authorization systems require separate accounts for each role and do not allow users to act on behalf of others without re-authentication, leading to inefficiencies and increased overhead in managing user permissions.
Innovation Solution
A system that utilizes a rights database to store roles and user identifiers, with a policy decision point that authorizes service requests based on the capabilities associated with specified roles, allowing one user to act on behalf of another while validating their authorization through their assigned roles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If separate accounts are required for each role, then authorization precision is improved, but device complexity increases
Solution Approach 1:
The patent merges multiple role accounts into a single user account by implementing a role assignment mechanism where roles are stored and managed separately from user identities. This allows one account to assume multiple roles dynamically, reducing the number of accounts needed while maintaining precise authorization control through role-based permission checking.
Solution Approach 2:
The system implements multi-functionality by allowing a single user account to perform multiple roles. The role assignment mechanism enables one account to be assigned different roles for different operations or time periods, making the account universal rather than role-specific, thereby reducing system complexity while preserving authorization precision.
2Reliability
If re-authentication is required to switch roles, then security is improved, but loss of time increases
Solution Approach 1:
The system performs preliminary action by pre-assigning roles to user accounts and storing these assignments in the rights database. When role switching is needed, the system simply retrieves the pre-configured role information rather than requiring re-authentication, thus maintaining security through pre-established permissions while eliminating time loss from repeated authentication.
Solution Approach 2:
The system implements dynamics by allowing role assignments to change over time without requiring account creation or re-authentication. Roles can be assigned, removed, or modified dynamically through the policy decision point, enabling flexible role switching that maintains security through centralized policy control while reducing time loss compared to static role accounts.
3Manufacturing precision
If individual user profiles are customized, then authorization precision is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by separating user identities from role definitions and permissions. Instead of customizing each user profile individually with all their permissions, the system segments authorization into reusable role templates that can be assigned to multiple users. This reduces configuration overhead while maintaining precise authorization control through the modular role-based structure.
Solution Approach 2:
The system uses copying by creating reusable role templates that can be assigned to multiple users. Instead of customizing each user's profile from scratch, administrators can define a role once and copy/assign it to multiple users, significantly reducing configuration overhead while maintaining precise authorization control through the standardized role definitions stored in the rights database.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods described herein relate to role-based authorization systems which allow customization of role templates as well as the ability, using roles, for one user to act on behalf of another user.